Subject: [Txauth] Éric Vyncke's No Objection on charter-ietf-gnap-00-00: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Wed, 24 Jun 2020 02:15:18 -0700

Éric Vyncke has entered the following ballot position for
charter-ietf-gnap-00-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-gnap/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Some quick comments:
- the charter itself is rather verbose, sometimes convoluted, and often
directive (looking like the charter is about rubber stamping existing work) -
nits please expand "AS" before first use - missing milestones dates ? - should
this new WG work with others?

---

From: Roman Danyliw <[email-masked]>
Date: Wed, 24 Jun 2020 14:26:34 +0000

Hi Eric!

Thanks for the review.  More inline ...

> -----Original Message-----
> From: iesg <[email-masked]> On Behalf Of Éric Vyncke via Datatracker
> Sent: Wednesday, June 24, 2020 5:15 AM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: Éric Vyncke's No Objection on charter-ietf-gnap-00-00: (with
> COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 
> - the charter itself is rather verbose, sometimes convoluted, and often directive
> (looking like the charter is about rubber stamping existing work) 

Yes, it is long.  These words were carefully chosen after a deliberate, iterative process to gain consensus.  No existing work is getting rubber stamped -- quite the contrary, there are at least two competing proposals to form the basis of the starting point. 

>- nits please
> expand "AS" before first use 

Fixed in version 00-01.

> - missing milestones dates ? 

Good point.  I'm working on getting these documented.

> - should this new WG
> work with others?

Yes.  The 00-01 version now contains:

"The working group will cooperate and coordinate with other IETF WGs such as
OAUTH, and work with organizations in the community, such as the OpenID, 
as appropriate."

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 24 Jun 2020 14:34:03 +0000

Roman

Thank you for replying to my questions: everything is clear now for me.

-éric

-----Original Message-----
From: Roman Danyliw <[email-masked]>
Date: Wednesday, 24 June 2020 at 16:26
To: Eric Vyncke <[email-masked]>, The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: Éric Vyncke's No Objection on charter-ietf-gnap-00-00: (with COMMENT)

    Hi Eric!

    Fixed in version 00-01.

---

From: Justin Richer <[email-masked]>
Date: Wed, 24 Jun 2020 11:15:20 -0400

Good clarifications, thank you for the feedback! 

One nit, for Roman: that should probably be “the OpenID Foundation”. I would personally also add “the Kantara Initiative” to the list, as that is the home of the User Managed Access (UMA) work that is also directly influencing this. So a proposed rewording:

"The working group will cooperate and coordinate with other IETF WGs such as
   OAUTH, and work with organizations in the community, such as the OpenID
   Foundation and the Kantara Initiative, as appropriate."

There are of course others, like W3C and DIF who are doing identity and authenticator work that would plug into GNAP, but it is probably overkill to list everyone, right? 

All that said, this is a minor note. Even listing just “the OpenID Foundation” without Kantara would be fine with me.

 — Justin

> On Jun 24, 2020, at 10:34 AM, Eric Vyncke (evyncke) <evyncke=[email-masked]> wrote:
> 
> Roman
> 
> -- 
> Txauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth

---

From: Denis <[email-masked]>
Date: Wed, 24 Jun 2020 18:38:20 +0200

Hello Eric,

I reply as a member of this BoF. You are perfectly right when you write:

    "The charter itself is rather verbose, sometimes convoluted, and
    often directive (looking like the charter is about rubber stamping
    existing work)".

The charter is far too long and not understandable (at least to me). I 
also got the impression that its goal is to rubber stamp two existing 
proposals.

The charter is missing to explain the trust relationships and the 
privacy properties that will form the basis of the model and the major 
architecture differences
(if any) with OAuth 2.0.

I have some difficulties to understand how the replies you got are now 
making "everything clear for you", since there is no proposal to make 
the charter shorter (and clearer).

Denis